Business Email Compromise: What to Do When Banking Information on an Invoice Is Changed

Business email compromise (BEC) is a form of fraud in which an attacker impersonates a trusted person or gains access to a legitimate email account and uses that trust to redirect money or obtain sensitive information. One of the most damaging versions involves an invoice that appears normal except for changed bank or wire instructions.

The message may come from a look-alike domain, a spoofed sender, or a real mailbox that has been compromised. Because the attacker may be reading an existing conversation, the wording, timing, names, project details and invoice amounts can look convincing. Treat an unexplained change in payment instructions as a security event, not simply an accounting discrepancy.

Contact the sending financial institution immediately. Ask its fraud department about recalling or freezing the transfer and provide the receiving account information, amount, date and transaction details. Speed matters. The FBI also directs BEC victims to report the incident through the Internet Crime Complaint Center (IC3).

Do not continue the suspicious email conversation to verify the transaction. Contact the legitimate vendor or customer through a phone number or contact method you already know to be genuine. Preserve the suspicious messages, invoices, headers and payment records rather than deleting them.

A fraudulent message does not automatically prove that your Microsoft 365 or other email account was hacked. Investigation should distinguish among account compromise, domain spoofing, a look-alike domain, compromise of the other party, or information obtained elsewhere.

For Microsoft 365, useful indicators can include unfamiliar sign-ins, unexpected forwarding, suspicious inbox rules, deleted or moved messages, unusual sent mail, changed authentication methods and unexplained account activity. An investigation should also consider whether other users, shared mailboxes or cloud data were exposed.

If compromise is suspected, secure the affected identity and sessions, reset credentials through a trusted process, review multi-factor authentication methods, remove unauthorized forwarding or rules, and examine administrative changes. The exact steps depend on the environment and what evidence needs to be preserved.

Also review payment procedures. A technical fix alone does not prevent another fraudulent transfer if employees still accept banking changes by email without independent verification.

Require employees to verify new or changed payment instructions using a known phone number or an established secondary channel. Do not rely on contact information supplied in the same email requesting the change. For significant transfers, consider requiring approval by more than one person.

Multi-factor authentication, email security controls, employee awareness, restricted administrative privileges and ongoing monitoring reduce risk, but business process controls remain essential because BEC frequently targets people as much as technology.

WNC IT Pro can help businesses investigate available account and email evidence, secure affected Microsoft 365 environments, review forwarding and authentication settings, improve email security, document technical findings, strengthen account controls and coordinate technical information with a business's bank, attorney, insurer or law enforcement when appropriate.

We do not promise recovery of stolen funds or claim that every incident can be definitively attributed. The goal is to understand what the available evidence supports, contain the problem and reduce the likelihood of recurrence.